> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Partners in BC Correios > Confine a partner's BC Correios credential to the mails you choose, tell it how to name them on each request, and read the refusals it receives. A [partner](https://docs.lerian.studio/en/platform/access-manager/features/partners/overview) can call [BC Correios](https://docs.lerian.studio/en/rails/bc-correios/what-is-lerian-bc-correios.md) with its own credential. In BC Correios, you confine that credential to some mails. This page shows how to choose that scope, what it reaches, and what the partner receives when it goes outside it. Every BC Correios partner needs a scope: at least one mail. ## Step by step *** **1. Choose what the partner works with** One installation of BC Correios serves one institution, so the mail is the only item you can confine a partner to. The **API field** is the `field` of a scope entry; the Console shows the name in the first column. | Restriction | API field | What the partner reaches | What it is refused | | - | - | - | - | | **Mail** | `mailId` | Its own mails: reading them, their attachments and their AI analysis, marking them as read, archiving and restoring them, asking for a new AI analysis, replying to them, and reading their audit trail. | Other mails, the mail list and the mail count, a new message that replies to no mail, settings, the dashboard, and the audit export. | Each value is the ID that BC Correios returns for the mail. The scope catalog lists the BC Correios restriction. Read it with [Retrieve a product's scope catalog](https://docs.lerian.studio/en/reference/platform/access-manager/retrieve-a-product-s-scope-catalog.md) for `plugin-bc-correios`. Some rules apply to every scope: * A request that does not name a mail is refused. For example, a partner cannot list or count the mails of your institution: it reads only the mails whose IDs you give it. * A query that lists several mails is refused when any one of them is outside the scope. * Routes that act on the whole installation are refused to every partner: settings, the dashboard, the audit export, the runtime configuration, and the streaming manifest. **2. Give the partner its permissions and scope** Create the partner, or change it, in the [Console](https://docs.lerian.studio/en/platform/access-manager/features/partners/console.md) or with the [Identity API](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md). The product slug is `plugin-bc-correios`. * Add at least one scope entry for BC Correios. Without one, Access Manager refuses the partner with `400` and `IDE-1060`. * Check the resources and actions. The most you can give is what the `plugin-bc-correios-editor-role` role holds in your tenant. Access Manager checks each write you give against the scope. A write that acts on the whole installation is never given to a partner, and is refused with `400` and `IDE-1056`. The Console marks the line **Outside the scope**. In BC Correios, these writes are creating and changing settings, testing the BC Correio and AI connections, and changing the runtime configuration. The writes a partner can receive are `mails` with `post` (a reply, a new AI analysis) and `mails` with `put` (archive, restore). **3. Create its BC Correios application** Create the partner's application with the product `plugin-bc-correios`. See [Create the partner's applications](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md#create-the-partners-applications) in the API guide, or [in the Console](https://docs.lerian.studio/en/platform/access-manager/features/partners/console.md#create-the-partners-applications). Send the client ID and the client secret to the partner through a secure channel. **4. Tell the partner how to name its mails** On most routes the mail is already in the path. On the others, the partner names it in the query or the body that BC Correios already has. Every route below uses the `/api/v1/correios` base path. | Routes | Writes | Reads and routes by ID | | - | - | - | | One mail: `/mails/{mailId}`, `/mails/{mailId}/ai-status`, `/mails/{mailId}/attachments/{attachmentId}` | `PUT /mails/{mailId}/read`, `/archive`, `/restore` and `POST /mails/{mailId}/reanalyze`: path `mailId` | Path `mailId` | | Send: `/mails/send` | To reply: body `inReplyToMailId`. A new message names no mail and is refused | None | | Audit trail: `/audit` | None | To read: query `mailId` | | Mails: `/mails`, `/mails/count` | None | None: the routes act on the whole mailbox and are refused | | Settings, dashboard, audit export: `/settings`, `/dashboard/summary`, `/dashboard/categories`, `/audit/export` | None: the writes are never given to a partner | None: the routes act on the whole installation and are refused | > [!WARNING] > > A partner never lists mails: give it the ID of each mail it must work with, and add that ID to its scope. A mail that arrives later is not in the scope until you add it. **5. Confirm that it works** This check assumes the partner has the `mails` resource with the `get` action on BC Correios, and a scope with one mail. Use the partner's credential. Read the mail in its scope. The answer is `200`: ```bash theme={null} CORREIOS_BASE_URL="https://correios./api/v1/correios" # your BC Correios base URL CORREIOS_BEARER_TOKEN="paste-the-partner-access-token-here" MAIL_ID="paste-a-mail-id-in-the-scope-here" curl -s -o /dev/null -w '%{http_code}\n' \ -H "Authorization: Bearer ${CORREIOS_BEARER_TOKEN}" \ "${CORREIOS_BASE_URL}/mails/${MAIL_ID}" ``` Send the same request with a mail outside the scope. The answer is `403`. To see the code, drop `-o /dev/null`: the response body carries `BCC-1003`. ## If something fails *** | Code | Status | What it means | What to do | | - | - | - | - | | `BCC-1003` | 403 | The request is outside the partner's permissions or outside its scope, or it does not name a mail. | Check that the request names its mail in the field of that route, with a value in the partner's scope. Check also that the partner has the permission for that route. | | `BCC-0002` | 400 | `inReplyToMailId` received a list of mails. | Send one mail in the field. | | `BCC-1002` | 401 | The partner is suspended, or the request is outside the partner's validity window. | Reactivate the partner, or change its validity window. | The answer does not say whether the permissions or the scope refused the request. This is on purpose: a partner cannot use a refusal to learn which mails exist outside its scope. For every other code, see the [BC Correios error list](https://docs.lerian.studio/en/reference/rails/bc-correios/bc-correios-error-list.md). For the refusals when you create or change a partner, see [Error codes](https://docs.lerian.studio/en/platform/access-manager/features/partners/api.md#error-codes) in the API guide. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.